These slides provide an overview of the changing landscape for data protection and journalism in decade or so since the Leveson Inquiry. As well as detailing the core public interest and incompatibility tests, they look at developments in case law, at the ICO and under the GDPR and DPA 2018. They are intended to provide background to the ICO consultation on a data protection and journalism code of practice which runs until 10 January 2022.

1. Dr David Erdos
Centre for Intellectual Property & Information Law
University of Cambridge

2. DP in the Media: Basic Outline (from 1990s)
 Data Protection has enormously broad scope (for
natural persons) & stringent default rights & duties.
 But is subject to a wide-ranging journalistic defence:
 Reasonable belief in the public interest,
 Reasonable belief in the incompatibility re: default.
 Peremptory remedial limits also apply including bar
on pre-publication injunction & limits on ICO.
 DP in practice has been playing a secondary role to
defamation and misuse of private information.

3. Data Protection: The Basic Scheme
Data Principles
& Legal
Grounds
Sensitive Data
Rules
Transparency
& Control
Rights
Integrity &
Supervision
Personal
Data
Processing


4. Leveson 2012: Understanding of DP
“In my judgment, on the face of it, a combination of this kind of case
by case approach to the ICO’s law enforcement function [civil &
criminal], and the application to the press of the ICO’s general duties
to promote compliance and good practice, do add up to a significant
potential role in guaranteeing public confidence in the culture,
practices and ethics of the press in relation to personal information.
However, the Inquiry saw little evidence of the realisation of
that potential, or, in practice, of that role having been
fulfilled.” (p. 1065)

5. Leveson 2012: Criticisms of ICO
“ICO did not effectively grasp the full implications, and indeed,
opportunities of the case. As a result:
(a) previous misconduct was inadequately brought to justice and
was not otherwise addressed as a matter of law enforcement;
(b) the risk of continuing breaches of the law and standards was
not effectively addressed;
(c) the interests of the victims were inadequately protected; and
(d) an important opportunity was missed to address problems in
the culture, practices and ethics of the press in relation to the
acquisition and use of personal information, which could have
an impact beyond the facts of the Motorman case.” (p. 1052)

6. Leveson: Main DP Recommendations
Civil Justice Council
 Make recommendations on
damages esp. re distress
ICO
 Good Practice Guidelines
 Regulatory Policy
 Guidance for Public
 Long-term engagement
and strategy on issue
 Annual Reports updates
Parliament
 Remove all peremptory
remedial limits
 Exemption focused on
objective necessity & public
interest
 Remove from ambit: fairness,
lawfulness, purpose limitation,
accuracy & subject access
(minus sources)

7. Court Developments
 Privacy: Stunt v Associated Newspapers (2017)
abandoned; no “breakthrough” civil case
 Reputation/Accuracy:
 Moulay v Elaph Publishing: EWCA upholds concurrent
DP & defamation claim 2017; 2018 settlement includes
DP remedies (damages & costs, correction, erasure)
 Aven v Orbis Business Intelligence: Not strictly media
case but EWHC 2020 find reference to “illicit [Putin]
cash” inaccurate sensitive data; £18K damages to each

8. ICO: Policy and Guidance
 Guidance to the Public but originally very limited (Jan 2013)
 Regulatory Policy amended to include Media (August 2013)
 Guidance for Journalists (September 2014)
 Stressed broad scope & potential duties
 Focus on proportionality analysis throughout
 Strong deference on public interest, less on incompatibility.
 Annual Reports: Sparse and sporadic mention esp after 2012/13

9. ICO: Regulatory Action
 Facts: True Vision films maternity (including miscarriage)
consultations at hospital. No consent and ?inadequate notice.
 April 2019 - Initial ICO response: £120,000 fine
 January 2021 – Tribunal determination: Substantive findings
slightly more limited & £20,000 fine (ICO did not contest latter)

10. Parliament: DPA 2018 Outcomes
 Norms: Special regime extended to criminal law but:
 Controller must itself have regard to any relevant designated
self-regulatory norms during initial public interest test.
 ICO must issue fuller guidance for the public.
 ICO must consult on & draft co-regulatory journalism code of
practice for Parliamentary approval which ICO, courts &
tribunals must then take into account.
 Enforcement: ICO fines now require leave of court but:
 ICO must review media compliance every 4-5 years and
granted extensive powers to do this
 Government must review alternative dispute resolution every
years.

11. Conclusions & Looking Ahead
 Data Protection is playing a more extensive role here than
ten years ago
 Statutory Code of Practice and ICO Media Review has
potential to further expand this (especially as will influence
other actors including the courts)
 But ICO has been slow to deliver on statutory tasks (final
Code was promised in 2019) and without more commitment
momentum likely to be lost
 But Draft Code has now been published so watch this space
and have your say.